i recently had a P2 get marked Triaged. does this mean i'll get awarded a bounty soon? does it also mean it can no longer be a duplicate?

In an organization, I found out if a lower user changes his own personal email to an untrusted email or a certain email that looks like it came from a specific temporary email provider, it could disable the entire org, Why does that happen?

I was hunting on a bug bounty program for a Russian company whose platform was designed to help users analyze reviews and other data.

I started testing the invitation functionality. At first, everything seemed to work as expected.

You enter the email address of the user you want to invite, select their role, and send the invitation.

However, what caught my attention was the request being sent in this format:

POST /v1/user/add-role?userid=2345

As you probably expected, that userid immediately caught my attention.

I suspected that the application was somehow resolving the user's email address to their internal user ID.

So I changed the userid to several other IDs, and surprisingly, the server accepted the requests and sent invitations to other users.

Even more interestingly, their email addresses were exposed in my Pending Invitations list.

This meant that with a simple ID enumeration/brute-force approach, it was potentially possible to enumerate and disclose a large number of users' email addresses across the platform.

Transitioning from bug bounty research to security consulting — what actually worked for you?

I have spent the last few years doing independent security research and coordinated disclosure. Some highlights:

\- 6 CVEs across AI agent platforms, web apps, and open-source tools

\- Paid bounties from Qdrant ($1,000, CVSS 9.8 auth bypass) and X-Road (€2,000, path traversal, disclosed via CERT-EE/RIA)

\- Vendor acknowledgments from BSI Germany and CERT-EE/RIA

\- A sandbox escape in an AI orchestration platform (FlowiseAI, GHSA published)

I can read source code, build minimal PoCs, and write reports that developers actually understand.

Here is my problem: I want to move from bug bounty / black-box research into authorized white-box source code reviews and security consulting for startups. But after 6 months of trying, I have not landed a single paid consulting engagement.

What I have tried:

\- Cold outreach to startup engineering leaders

\- Sharing research on LinkedIn and Twitter

\- Building a small open-source research tool

\- Pricing experiments from small quick checks to full audits

What I think is holding me back:

\- I am still pitching like a bug bounty hunter, not like a consultant who delivers fixable findings

\- I have imposter syndrome around pricing — I see peers charging $10k+ for source code reviews and I feel like a fraud asking for €1k

\- I am not sure if my outreach is targeting the right stage of company or the right decision-maker

For those of you who made the jump from vulnerability research / bug bounty to actual consulting or product security roles:

1. How did you frame your first paid engagement? Was it a "quick check," a full audit, or something else?

2. Did you target a specific niche (e.g., AI startups, fintech, open-source projects) or stay general?

3. How did you overcome the fear of naming a price that felt "too high" for your first client?

I am not looking for a job. I am trying to build a practice. But I am also realistic enough to know I might be doing this wrong.

Be brutal. I need the truth.